1. Safe Harbor. If you submit a vulnerability report to us, using the process outlined below, in compliance with all of the terms in these Terms of Use, we will not pursue civil action or initialize a complaint to law enforcement against you for accessing our systems without authorization in order to identify that vulnerability.
  2. Submission Process. Please submit all vulnerability reports to us by email at the email address ResponsibleDisclosure@bcg.com. In each report submitted, include:

    a. a description of the vulnerability;
    b. the URL, IP address, port, or other information that would assist us in locating the vulnerability;
    c. detailed and clear steps to reproduce the issue (including logs, screenshots, responses, or other evidence) or proof of concept code;
    d. how you found the issue;
    e. presumed impact;
    f. any remediation steps you would suggest; and
    g. your name and contact details

  3. Scope. You may not access any individual workstation, or system, network, content, application or data of any third party, in connection with this program. The safe harbor described above does not apply to any such system, network content, application or data.
  4. Methodology. You may not engage in any denial of service attack, attempts to compromise physical security or enter physical premises, or other destructive methodologies. As soon as you have identified the vulnerability, you must cease testing of it and report it as described above. The safe harbor described above does not apply to any activity that violates the terms of this Section.
  5. No Access to Personal Data or Misuse of Data. By participating in this program, you represent that you have not at any time accessed personal data of our customers or users found on our systems, and that, in the event that you inadvertently acquired any, you have securely deleted that data. You represent that you have not, and covenant that you will not, misuse any data extracted from our environment for any fraudulent, malicious, defamatory, abusive, threatening, unlawful or otherwise improper purpose.
  6. Intellectual Property Rights. By submitting information relating to a vulnerability, you grant us a perpetual, worldwide, royalty-free, fully paid-up license to use and disclose any information you submit, including any proofs of concept, patches, improvements, suggestions, code samples or any other information, in connection with the vulnerability to analyze, remediate or improve our systems and networks, incorporate it into our products or services, and to conduct further testing, or for any other legitimate business purpose. We do not grant you any intellectual property rights to any image, information, writing, invention, code or other creation in connection with these Terms of Use.
  7. Sanctions. By submitting information relating to a vulnerability, you represent that you are not subject to any export sanctions or other trade restrictions, whether due to being included on the sanctions list maintained by the U.S. Office of Foreign Assets Control, or other governmental bodies in the United States or European Union, individually, being a member of an organization on that list, or being a resident of a country that is sanctioned by the United States or European Union.
  8. Independent Contractor. Nothing in connection with your submission of a vulnerability shall indicate the you are an employee of BCG and the relationship between you and BCG shall not constitute a partnership, joint venture or agency. You shall not have the authority to make any statement, representation or commitment on BCG’s behalf.
  9. Disclaimer of Liability and Obligation. BCG, it’s officers, affiliates, representatives, contractors and employees shall not be liable to you in connection with these Terms of Use for any direct, indirect, exemplary, incidental, special or consequential damages. Unless otherwise agreed by BCG, any information submitted by you in connection with a vulnerability is provided at no charge and BCG shall not owe you any fee for that submission or any services performed or expenses incurred.
  10. Miscellaneous. These Terms of Use are governed by the laws of the Commonwealth of Massachusetts, without regard to conflict of laws principles. You shall not use any logo or other trademark of BCG without our explicit prior consent.
  11. Encrypted Messages. Please use our PGP key posted in the collapsible element below to send an encrypted message.
PGP Public Key
-----BEGIN PGP PUBLIC KEY BLOCK-----
Version: PGP Universal 11.5.2 (Build 138)

mQENBGqZQtsBCACy1OVRIulz7EkE12MnISjoO3LrimCrvzyH2pF2aRGNctdgfoM+ ZLjTScJHE06hMNTIaXA0a1w3L7RZWmzUXrNn1wXFKuHNpJIW/j0BvaPYCS6JhZVD Du4OHQ3wFYVRo6rTtgfTwVwPYMN7e092mS8QuEYVz5qC0gkxTKiT6xvjWC1LWuuW DCcBf2A+b96BlbuUx+8zGb9qN1pCV0j1CdouhgyFy+zaWLqeu9Fhrm6AGE62xl4T bScc35yBgD1PS39948n0+OwZEZykqtvDtDTfgxgpibrC53ySD1X5jWSQIRSEdvfC /n8Av13hLRnEyxFYHmaRNYMa0X49oZ6ne8NxABEBAAG0NlJlc3BvbnNpYmxlIERp c2Nsb3N1cmUgPHJlc3BvbnNpYmxlZGlzY2xvc3VyZUBiY2cuY29tPokGIwQQZAgG FgUCaplC2wUDAeEzgAIbDMVFZAEBBDCCBf0wggPloAMCAQICE3oAC2xFl6hHiCfx Du4AAAALbEUwDQYJKoZIhvcNAQELBQAwPzETMBEGCgmSJomT8ixkARkWA2NvbTET MBEGCgmSJomT8ixkARkWA2JjZzETMBEGA1UEAxMKQkNHLUFNUi0wMTAeFw0yNjA5 MDMwOTUwMTlaFw0yNzA5MDMwOTUwMTlaME8xHzAdBgNVBAMTFlJlc3BvbnNpYmxl IERpc2Nsb3N1cmUxLDAqBgkqhkiG9w0BCQEWHXJlc3BvbnNpYmxlZGlzY2xvc3Vy ZUBiY2cuY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAstTlUSLp c+xJBNdjJyEo6Dty64pgq788h9qRdmkRjXLXYH6DPmS400nCRxNOoTDUyGlwNGtc Ny+0WVps1F6zZ9cFxSrhzaSSFv49Ab2j2AkuiYWVQw7uDh0N8BWFUaOq07YH08Fc D2DDe3tPdpkvELhGFc+agtIJMUyok+sb41gtS1rrlgwnAX9gPm/egZW7lMfvMxm/ ajdaQldI9QnaLoYMhcvs2li6nrvRYa5ugBhOtsZeE20nHN+cgYA9T0t/fePJ9Pjs GRGcpKrbw7Q034MYKYm6wud8kg9V+Y1kkCEUhHb3wv5/AL9d4S0ZxMsRWB5mkTWD GtF+PaGep3vDcQIDAQABo4IB4DCCAdwwPAYJKwYBBAGCNxUHBC8wLQYlKwYBBAGC NxUIhrKbeIPGkl79mTqFlKElh+rhN2yGuNl7gZGtQgIBZAIBJjATBgNVHSUEDDAK BggrBgEFBQcDBDAbBgkrBgEEAYI3FQoEDjAMMAoGCCsGAQUFBwMEMA4GA1UdDwEB /wQEAwIFIDBEBgkqhkiG9w0BCQ8ENzA1MA4GCCqGSIb3DQMCAgIAgDAOBggqhkiG 9w0DBAICAIAwBwYFKw4DAgcwCgYIKoZIhvcNAwcwHQYDVR0OBBYEFBMJTcqqHx3H siu+RuBWWksJjL7oMB8GA1UdIwQYMBaAFKuhOIFFsbrOHNKuTpTaTHi032kTMD8G A1UdHwQ4MDYwNKAyoDCGLmh0dHA6Ly9wa2kuYm9zdG9uY29uc3VsdGluZy5jb20v QkNHLUFNUi0wMS5jcmwwgZIGCCsGAQUFBwEBBIGFMIGCME0GCCsGAQUFBzAChkFo dHRwOi8vcGtpLmJvc3RvbmNvbnN1bHRpbmcuY29tL0FNUkFQQ0FTMVcuYmNnLmNv bV9CQ0ctQU1SLTAxLmNydDAxBggrBgEFBQcwAYYlaHR0cDovL29jc3AuYm9zdG9u Y29uc3VsdGluZy5jb20vb2NzcDANBgkqhkiG9w0BAQsFAAOCAgEALnLa/OWyKQZ2 omi/FPHJjnEHonAtbSdL2rB6/mN+vLGClTmyl7JaCPwCqI5EUsXzgihD91bFqpkz O2mgzRdIQp0Mp2f3aWGpcs4M4RgzJC21BSoDKl33KVNUobR2capeNL0b/HGfrv1+ 5mwCa5Ru0nyopl198jp3ivjIOLnFYT8NKyZ66jHthUmxCDbkfsssnEQav/ZsRWjj /iNT7LBRs1dantFqtJ3qU+Q/AhlDBnk07gS1+ty6//pBwrTvudkrQRUh+gN/VMXW vcksJGndkT9F6Gz5DJrmTVI8P7OF8MAkFEU3oW9AW2UXRBqevuDWSPoCfBoPG7G0 AhYQBbBdVCW1H4es4LlsxUtmsHv5nDK4sUHBCZ9aHV/o4U7HBSt+ncu5pRrxz7o3 Q9rOqwKdOTtmSr67Jlm6H0XHSsJ6wR6s6PjWSNhJpRZmMW5tqhaicuKwaScnRiGu HpIsrs1lnPS89Ditvg6aFz6vUml7RF9B+pkAbUibVNawjVgrgRcjz1QHlJkwJ41Y p2V8H2PzQQhoRNJMAiL4GQMkguLp0PyAv+HdulXAHAe5Z+xRcREcXcoITQyd4qdO Ie+VL5EdCKTIrBnkYf50dCokvnZe5MH8GjqlfaId9EPgPu4N5+tMO47fL06/FDAE jn+G3Emn29ROWqKqeE2jAXJceDNV+mcAAAAAAAEBiQEcBBABCAAGBQJqmUXeAAoJ EL0x+ebBarb1A7QH/2KHQsH3WJGDrcUt84IciXQLtaJpFWt/SPmKK6hBqA9icJXg TKOv7+QLovfySPQsNIwWI66PSrTYJVKurIV6nu6YHWs02ZfpoKZDPYHGCgg0FJ+W wnfFPvBYnWB2KqBMSP9dLVp8z8Yuku/BcxUbWoy6NXAN/Yo71SouXBh4vNAzyHqg ++QQzyFagRgnCLMr1yzTyUNdjcuZJO7qwZKV94DA94pCKLzRyJFO+Dl11gkDNE7s 99m70WIK8mr9RqXvNPxO/Arua11Nbnj2oHXKbAKwt9kXkyMCix0aoNAAk39HSGQf xJCj6CH02bJtlM+m6i0/H5/n01YgZoGTHIsF7LeJBLUEEGQIBKgFAmqZRd4FAxLM AwACGw7D12QBAQQwggSPMIIDd6ADAgECAhQpuP6VUUmYFybYtvrISA9bH6WSVDAN BgkqhkiG9w0BAQsFADCBpDElMCMGCSqGSIb3DQEJARYWRW5jcnlwdGlvblRlYW1A YmNnLmNvbTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1BMQ8wDQYDVQQHEwZCb3N0 b24xJDAiBgNVBAoTG1RoZSBCb3N0b24gQ29uc3VsdGluZyBHcm91cDEYMBYGA1UE CxMPR2xvYmFsIFNlcnZpY2VzMRAwDgYDVQQDEwdiY2cuY29tMB4XDTI2MDkwMzEw MDMxMFoXDTM2MDgzMTEwMDMxMFowTzEsMCoGCSqGSIb3DQEJARYdcmVzcG9uc2li bGVkaXNjbG9zdXJlQGJjZy5jb20xHzAdBgNVBAMTFlJlc3BvbnNpYmxlIERpc2Ns b3N1cmUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCy1OVRIulz7EkE 12MnISjoO3LrimCrvzyH2pF2aRGNctdgfoM+ZLjTScJHE06hMNTIaXA0a1w3L7RZ WmzUXrNn1wXFKuHNpJIW/j0BvaPYCS6JhZVDDu4OHQ3wFYVRo6rTtgfTwVwPYMN7 e092mS8QuEYVz5qC0gkxTKiT6xvjWC1LWuuWDCcBf2A+b96BlbuUx+8zGb9qN1pC V0j1CdouhgyFy+zaWLqeu9Fhrm6AGE62xl4TbScc35yBgD1PS39948n0+OwZEZyk qtvDtDTfgxgpibrC53ySD1X5jWSQIRSEdvfC/n8Av13hLRnEyxFYHmaRNYMa0X49 oZ6ne8NxAgMBAAGjggELMIIBBzAdBgorBgEEAZpJCAEBBA8XDTI2MDkwMzA5NTAx OVowDgYDVR0PAQH/BAQDAgO4MBMGA1UdJQQMMAoGCCsGAQUFBwMEMBEGA1UdDgQK BAjISA9bH6WSVDAoBgNVHREEITAfgR1yZXNwb25zaWJsZWRpc2Nsb3N1cmVAYmNn LmNvbTATBgNVHSMEDDAKgAi9MfnmwWq29TBvBgNVHR8EaDBmMGSgYqBghi5odHRw Oi8vcGtpLmJvc3RvbmNvbnN1bHRpbmcuY29tL0JDRy1FVVItMDEuY3Jshi5odHRw Oi8vcGtpLmJvc3RvbmNvbnN1bHRpbmcuY29tL0JDRy1BTVItMDEuY3JsMA0GCSqG SIb3DQEBCwUAA4IBAQAYCRCiWQ88IHpxgud9MrAyvF1DBblhGdBpUYwzB25S5cOI QgRVpGG6ZsUWnqXGMymm+O+UxJu6TduWqBMpEViBU3TadfMrIZjS0xuIVxykLv3K 7UiLZ2/bEDG2UkYHoyWYOfr/PXwZ1LSXtHjbQUHM8fK8Rj/9B56vyEJe+29lyU1t xk/j3fupboEfs8rbi2tH99D8lF6tjFCuN7aKArryLVOTNJ5ZmtcWL+1pYBE2ys8c TCU33FeMZuliWjSA+XALxodYAvwxjaHCOz8RckSrxkpSAagCTq9HTx+OTwCrGf/O hXVBb6wHaAP3Weq8RPiVz8iAeT+okLs4rRGWMGeWAAAAAAABAYkBZgQQAQgAUAUC aplF4wUJAAAAABsUAAAAAAARAAFrZXktdXNhZ2VAcGdwLmNvbY8FF4AAAAAVGGxk YXBzOi8va2V5cy5iY2cuY29tBRuOAAAABR4BAAAAAAoJEMhID1sfpZJUeFAIAKNd CsCT0JCpXNCPpfN2ozi3DN9dVgcXtPI3Yw/GBa1sJfi3eHRi01FZJEFlUB5QP9iN 7A990AfWcXAedusTwgtwCkwngM+O/flD4V5u/dJNm7BIy6pV+MdsUMaJwXmNqpe9 q5+fgRor4vzq1+ls5z4H9PDfb59ufY7lutPoz+zIE99r25e9AHATHb7FhJpKfj+X UltjFhTqAPbgskRWE2yKMjRNp7VUdP7IOtU8lm3VMNnIFbPBNxhfoUazVUGyiKZw 5wWpypuW7oY4CeZ/5Wk219EF9FLAiaPhzfREEFiFNm9WZyZ493Ev6Chd+VVnpPMN YNWWH9HuaASj9sGJsF8= =vQn/

-----END PGP PUBLIC KEY BLOCK-----

On behalf of ourselves and our users and customers, thank you again for helping us improve our cybersecurity.

BCG reserves the right, in its sole discretion, to modify the terms of the Responsible Disclosure Guidelines or to terminate any or all of them at any time.